CVE-2026-42845 PUBLISHED

Grav: Anonymous Page Content Overwrite via Form File Upload filename Override

Assigner: GitHub_M
Reserved: 30.04.2026 Published: 11.05.2026 Updated: 11.05.2026

The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4rc-p66m-x6qq). Public form uploads now strip path components from the POST-supplied filename and hard-block page-content extensions (md, yaml, yml, json, twig, ini) regardless of the configurable dangerous-extensions list. A permissive accept policy combined with the default destination: self@ could otherwise let an attacker overwrite the page's own .md and pivot to super-admin via a process: save action. This vulnerability is fixed in 9.1.0.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
CVSS Score: 7.7

Product Status

Vendor getgrav
Product grav-plugin-form
Versions
  • Version < 9.1.0 is affected

References

Problem Types

  • CWE-73: External Control of File Name or Path CWE